[PR #6185/512bf4b7 backport][stable-6] ldap moduls: add optional ca_cert_file option (#6217)

ldap moduls: add optional ca_cert_file option (#6185)

* add ca_cert_file option

* fix pr url

* Apply suggestions from code review

Co-authored-by: Felix Fontein <felix@fontein.de>

* update parameter name

---------

Co-authored-by: Felix Fontein <felix@fontein.de>
(cherry picked from commit 512bf4b77f)

Co-authored-by: Reto Kupferschmid <kupferschmid@puzzle.ch>

changelogs/fragments/xxxx-ldap-ca-cert-file.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - ldap modules - add ``ca_path`` option (https://github.com/ansible-collections/community.general/pull/6185).

plugins/doc_fragments/ldap.py

@@ -24,6 +24,11 @@ options:
       - The password to use with I(bind_dn).
     type: str
     default: ''
+  ca_path:
+    description:
+      - Set the path to PEM file with CA certs.
+    type: path
+    version_added: "6.5.0"
   dn:
     required: true
     description:

plugins/module_utils/ldap.py

@@ -34,6 +34,7 @@ def gen_specs(**specs):
     specs.update({
         'bind_dn': dict(),
         'bind_pw': dict(default='', no_log=True),
+        'ca_path': dict(type='path'),
         'dn': dict(required=True),
         'referrals_chasing': dict(type='str', default='anonymous', choices=['disabled', 'anonymous']),
         'server_uri': dict(default='ldapi:///'),
@@ -52,6 +53,7 @@ class LdapGeneric(object):
         self.module = module
         self.bind_dn = self.module.params['bind_dn']
         self.bind_pw = self.module.params['bind_pw']
+        self.ca_path = self.module.params['ca_path']
         self.referrals_chasing = self.module.params['referrals_chasing']
         self.server_uri = self.module.params['server_uri']
         self.start_tls = self.module.params['start_tls']
@@ -97,6 +99,9 @@ class LdapGeneric(object):
         if not self.verify_cert:
             ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
 
+        if self.ca_path:
+            ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, self.ca_path)
+
         connection = ldap.initialize(self.server_uri)
 
         if self.referrals_chasing == 'disabled':